Rackvio Community Edition — Software Bill of Materials (SBOM)

Overview

Rackvio publishes a Software Bill of Materials (SBOM) in CycloneDX JSON format for both the backend (Python) and frontend (Node.js) components. The SBOM provides a complete inventory of all third-party dependencies, enabling:

• Vulnerability scanning against CVE databases (NVD, OSV, GitHub Advisory)
• License compliance auditing for open-source obligations
• Supply chain transparency for enterprise procurement review

SBOM Format

Generating SBOMs

Prerequisites

The generation tools are not included in the Rackvio runtime containers. Install them in your local environment or CI pipeline.

Backend SBOM (Python)

The backend SBOM covers all Python packages in the application:

# Two venvs on purpose: the tool must NOT live in the environment it describes,
# or cyclonedx-bom and its ~25 dependencies are reported as Rackvio dependencies.
 
# 1. The environment to describe — production deps only.
python -m venv /tmp/bom-target
/tmp/bom-target/bin/pip install ./backend
 
# 2. The tool, isolated.
python -m venv /tmp/bom-tool
/tmp/bom-tool/bin/pip install cyclonedx-bom
 
# 3. Point the tool at the target interpreter.
/tmp/bom-tool/bin/cyclonedx-py environment \
  --of JSON --sv 1.5 --pyproject backend/pyproject.toml \
  --output-reproducible --validate \
  -o sbom-backend.json \
  /tmp/bom-target/bin/python

Rackvio backend uses pyproject.toml (PEP 621, built with Hatchling) — there is no requirements.txt and it is not a Poetry project. The cyclonedx-py environment form is the reliable path: it captures the exact resolved versions from the installed interpreter (run it inside the backend container).

Frontend SBOM (Node.js)

The frontend SBOM covers all npm packages:

# Generate SBOM using the CycloneDX npm plugin (npx, no global install needed)
cd frontend
npx @cyclonedx/cyclonedx-npm --spec-version 1.5 --output-format JSON \
  --omit dev --output-file ../sbom-frontend.json package.json
cd ..

Generate Both at Once

#!/usr/bin/env bash
# generate-sbom.sh -- Generate CycloneDX SBOMs for Rackvio
set -euo pipefail
 
echo "Generating backend SBOM (Python)..."
python -m venv /tmp/bom-target && /tmp/bom-target/bin/pip install --quiet ./backend
python -m venv /tmp/bom-tool   && /tmp/bom-tool/bin/pip install --quiet cyclonedx-bom
/tmp/bom-tool/bin/cyclonedx-py environment \
  --of JSON --sv 1.5 --pyproject backend/pyproject.toml \
  --output-reproducible --validate \
  -o sbom-backend.json /tmp/bom-target/bin/python
echo "  -> sbom-backend.json"
 
echo "Generating frontend SBOM (Node.js)..."
cd frontend
npx --yes @cyclonedx/cyclonedx-npm --spec-version 1.5 --output-format JSON \
  --omit dev --output-file ../sbom-frontend.json package.json
cd ..
echo "  -> sbom-frontend.json"
 
echo "SBOM generation complete."

What the SBOM Covers

Backend (sbom-backend.json)

Verified against backend/pyproject.toml and the generated SBOM on 2026-07-29. An earlier version of this table listed python-jose and aioredis — neither is a dependency of this project.

Frontend (sbom-frontend.json)

SBOM in Release Artifacts

For each tagged release, the release workflow:

1. Generates both files with the tools documented above.
2. Fails the release job if either file is not CycloneDX 1.5, or carries implausibly few components — so an empty-but-valid SBOM can never ship.
3. Uploads both as build artifacts.
4. Attaches both to the GitHub Release as downloadable assets.

Download them from the Assets section of any release .

SBOMs are not embedded in the Docker image labels as OCI annotations — an earlier version of this page said they were. Use the Release assets.

Note. Automated SBOM publication begins with releases tagged on or after 2026-07-29. Earlier releases have no SBOM asset — generate one locally with the commands above if you need it for an older version.

Scanning the SBOM

Using Trivy (recommended)

# Scan the backend SBOM for known vulnerabilities
trivy sbom sbom-backend.json
 
# Scan the frontend SBOM
trivy sbom sbom-frontend.json

Using Grype

grype sbom:sbom-backend.json
grype sbom:sbom-frontend.json

Using OSV-Scanner

osv-scanner --sbom=sbom-backend.json
osv-scanner --sbom=sbom-frontend.json

Updating the SBOM

The SBOM should be regenerated whenever dependencies change:

• After running pip install or updating pyproject.toml (backend)
• After running npm install or updating package.json (frontend)
• Before every tagged release

CI automation ensures the SBOM in release artifacts always matches the shipped code.